chore: update squizlabs/php_codesniffer requirement from ^3.10 to ^3.10 || ^4.0 #5

Open
dependabot[bot] wants to merge 1 commit from dependabot/composer/develop/squizlabs/php_codesniffer-tw-3.10or-tw-4.0 into develop
dependabot[bot] commented 2026-06-30 22:56:23 +00:00 (Migrated from github.com)

Updates the requirements on squizlabs/php_codesniffer to permit the latest version.

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.1 - 2025-11-10

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.5.

Added

  • Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
    • Syntax support for new PHP 8.5 features will follow in a future release.
    • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

  • The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a "wrong opener" and will auto-fix this by inserting a colon. #1316
  • Various housekeeping, including improvements to the tests and documentation.

Fixed

  • 4.x regression #1277: bring back whitespace tolerance in phpcs:ignore comma-separated rule reference lists.
    • Note: this bug did not affect phpcs:disable/phpcs:enable ignore annotations.
  • Fixed bug #968: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function.
  • Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
    • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
  • Fixed bug #1315: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a switch.
    • The sniff will now forbid - and auto-fix - multiple statements on one line for case/default and "case breaking" statements.
  • Fixed bug #1316: Tokenizer/PHP: a PHP close tag after a switch case condition or after a default keyword, was not regarded as a "scope_opener" for the case/default body.
  • Fixed bug #1316: PSR2.ControlStructures.SwitchDeclaration: the WrongOpener error is now also auto-fixable if the wrong opener is a PHP close tag.
  • Fixed bug #1316: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.

New Contributors

The PHP_CodeSniffer project is happy to welcome the following new contributors: @​andrewnicols, @​Soh1121

Statistics

Closed: 2 issues Merged: 8 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[4.0.1] - 2025-11-10

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.5.

Added

  • Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
    • Syntax support for new PHP 8.5 features will follow in a future release.
    • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

  • The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a "wrong opener" and will auto-fix this by inserting a colon. #1316
  • Various housekeeping, including improvements to the tests and documentation.

Fixed

  • 4.x regression #1277: bring back whitespace tolerance in phpcs:ignore comma-separated rule reference lists.
    • Note: this bug did not affect phpcs:disable/phpcs:enable ignore annotations.
  • Fixed bug #968: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function.
  • Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
    • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
  • Fixed bug #1315: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a switch.
    • The sniff will now forbid - and auto-fix - multiple statements on one line for case/default and "case breaking" statements.
  • Fixed bug #1316: Tokenizer/PHP: a PHP close tag after a switch case condition or after a default keyword, was not regarded as a "scope_opener" for the case/default body.
  • Fixed bug #1316: PSR2.ControlStructures.SwitchDeclaration: the WrongOpener error is now also auto-fixable if the wrong opener is a PHP close tag.
  • Fixed bug #1316: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.

#968: PHPCSStandards/PHP_CodeSniffer#968 #1216: PHPCSStandards/PHP_CodeSniffer#1216 #1277: PHPCSStandards/PHP_CodeSniffer#1277 #1279: PHPCSStandards/PHP_CodeSniffer#1279 #1315: PHPCSStandards/PHP_CodeSniffer#1315 #1316: PHPCSStandards/PHP_CodeSniffer#1316

[4.0.0] - 2025-09-16

This release contains breaking changes.

Upgrade guides for both [ruleset maintainers/end-users][wiki-upgrade-4.0-end-users], as well as for [sniff developers and integrators][wiki-upgrade-4.0-extenders], have been published to the Wiki.

You are strongly encouraged to read the upgrade guide applicable to your situation before upgrading.

This release includes all improvements and bugfixes from PHP_CodeSniffer [4.0.0-beta1], [4.0.0-RC1], [3.13.3] and [3.13.4].

Changed

  • Tokenizer/PHP: fully qualified exit/die/true/false/null will be tokenized as the keyword token and the token 'content' will include the leading backslash. #1201

... (truncated)

Commits
  • 0525c73 Merge pull request #1318 from PHPCSStandards/feature/changelog-4.0.1
  • 4c09fb4 Changelog for the 4.0.1 release
  • 7ed8ea2 Merge pull request #1316 from PHPCSStandards/feature/tokenizer-php-switch-cas...
  • b80dc24 Various sniffs: update tests to safeguard handling of case/default with P...
  • 6bd0af6 Squiz/NonExecutableCode: bug fix - false positive with PHP close tag after ca...
  • 6d61496 Squiz/SwitchDeclaration: make implied semicolon via close tag auto-fixable
  • 21c0e80 PSR2/SwitchDeclaration: make implied semicolon via close tag auto-fixable
  • 6327f77 Tokenizer/PHP: PHP close tag should be regarded as scope opener for switch ca...
  • 9397930 Squiz/SwitchDeclaration: bug fix - fixer conflict for single line code (#1315)
  • 2c13a90 Merge pull request #1308 from Soh1121/issue-968/fix-wrong-indentation-with-ar...
  • Additional commits viewable in compare view

Updates the requirements on [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/releases">squizlabs/php_codesniffer's releases</a>.</em></p> <blockquote> <h2>4.0.1 - 2025-11-10</h2> <p>This release includes all improvements and bugfixes from PHP_CodeSniffer <a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-3.x.md#3135---2025-11-04">3.13.5</a>.</p> <h3>Added</h3> <ul> <li>Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed. <ul> <li>Syntax support for new PHP 8.5 features will follow in a future release.</li> <li>If you find any PHP 8.5 deprecation notices which were missed, please report them.</li> </ul> </li> </ul> <h3>Changed</h3> <ul> <li>The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a &quot;wrong opener&quot; and will auto-fix this by inserting a colon. <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1316">#1316</a></li> <li>Various housekeeping, including improvements to the tests and documentation.</li> </ul> <h3>Fixed</h3> <ul> <li>4.x regression <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1277">#1277</a>: bring back whitespace tolerance in <code>phpcs:ignore</code> comma-separated rule reference lists. <ul> <li>Note: this bug did not affect <code>phpcs:disable</code>/<code>phpcs:enable</code> ignore annotations.</li> </ul> </li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/968">#968</a>: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function. <ul> <li>Thanks to <a href="https://github.com/Soh1121">Soichi Sato</a> for the patch.</li> </ul> </li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1216">#1216</a>: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 &quot;Using null as an array offset&quot; deprecation notices. <ul> <li>Thanks to <a href="https://github.com/andrewnicols">Andrew Lyons</a> for the patch.</li> </ul> </li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1279">#1279</a>: Tokenizer/PHP: on PHP &lt; 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream. <ul> <li>This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.</li> </ul> </li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1315">#1315</a>: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a <code>switch</code>. <ul> <li>The sniff will now forbid - and auto-fix - multiple statements on one line for <code>case</code>/<code>default</code> and &quot;case breaking&quot; statements.</li> </ul> </li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1316">#1316</a>: Tokenizer/PHP: a PHP close tag after a <code>switch</code> case condition or after a <code>default</code> keyword, was not regarded as a &quot;scope_opener&quot; for the <code>case</code>/<code>default</code> body.</li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1316">#1316</a>: PSR2.ControlStructures.SwitchDeclaration: the <code>WrongOpener</code> error is now also auto-fixable if the wrong opener is a PHP close tag.</li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1316">#1316</a>: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.</li> </ul> <hr /> <h3>New Contributors</h3> <p>The PHP_CodeSniffer project is happy to welcome the following new contributors: <a href="https://github.com/andrewnicols"><code>@​andrewnicols</code></a>, <a href="https://github.com/Soh1121"><code>@​Soh1121</code></a></p> <h3>Statistics</h3> <p><strong>Closed</strong>: 2 issues <strong>Merged</strong>: 8 pull requests</p> <p>Follow <a href="https://phpc.social/@phpcs"><code>@​phpcs on Mastodon</code></a> or <a href="https://twitter.com/PHP_CodeSniffer"><code>@​PHP_CodeSniffer on X</code></a> to stay informed.</p> <p>Please consider <a href="https://opencollective.com/php_codesniffer">funding the PHP_CodeSniffer project</a>. If you already do so: thank you!</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-4.x.md">squizlabs/php_codesniffer's changelog</a>.</em></p> <blockquote> <h2>[4.0.1] - 2025-11-10</h2> <p>This release includes all improvements and bugfixes from PHP_CodeSniffer <a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-3.x.md#3135---2025-11-04">3.13.5</a>.</p> <h3>Added</h3> <ul> <li>Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed. <ul> <li>Syntax support for new PHP 8.5 features will follow in a future release.</li> <li>If you find any PHP 8.5 deprecation notices which were missed, please report them.</li> </ul> </li> </ul> <h3>Changed</h3> <ul> <li>The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a &quot;wrong opener&quot; and will auto-fix this by inserting a colon. <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1316">#1316</a></li> <li>Various housekeeping, including improvements to the tests and documentation.</li> </ul> <h3>Fixed</h3> <ul> <li>4.x regression <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1277">#1277</a>: bring back whitespace tolerance in <code>phpcs:ignore</code> comma-separated rule reference lists. <ul> <li>Note: this bug did not affect <code>phpcs:disable</code>/<code>phpcs:enable</code> ignore annotations.</li> </ul> </li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/968">#968</a>: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function. <ul> <li>Thanks to [Soichi Sato][<a href="https://github.com/Soh1121"><code>@​Soh1121</code></a>] for the patch.</li> </ul> </li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1216">#1216</a>: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 &quot;Using null as an array offset&quot; deprecation notices. <ul> <li>Thanks to [Andrew Lyons][<a href="https://github.com/andrewnicols"><code>@​andrewnicols</code></a>] for the patch.</li> </ul> </li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1279">#1279</a>: Tokenizer/PHP: on PHP &lt; 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream. <ul> <li>This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.</li> </ul> </li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1315">#1315</a>: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a <code>switch</code>. <ul> <li>The sniff will now forbid - and auto-fix - multiple statements on one line for <code>case</code>/<code>default</code> and &quot;case breaking&quot; statements.</li> </ul> </li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1316">#1316</a>: Tokenizer/PHP: a PHP close tag after a <code>switch</code> case condition or after a <code>default</code> keyword, was not regarded as a &quot;scope_opener&quot; for the <code>case</code>/<code>default</code> body.</li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1316">#1316</a>: PSR2.ControlStructures.SwitchDeclaration: the <code>WrongOpener</code> error is now also auto-fixable if the wrong opener is a PHP close tag.</li> <li>Fixed bug <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1316">#1316</a>: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.</li> </ul> <p><a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/968">#968</a>: <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/968">PHPCSStandards/PHP_CodeSniffer#968</a> <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1216">#1216</a>: <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1216">PHPCSStandards/PHP_CodeSniffer#1216</a> <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1277">#1277</a>: <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1277">PHPCSStandards/PHP_CodeSniffer#1277</a> <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1279">#1279</a>: <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1279">PHPCSStandards/PHP_CodeSniffer#1279</a> <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1315">#1315</a>: <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/pull/1315">PHPCSStandards/PHP_CodeSniffer#1315</a> <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1316">#1316</a>: <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/pull/1316">PHPCSStandards/PHP_CodeSniffer#1316</a></p> <h2>[4.0.0] - 2025-09-16</h2> <p>This release contains breaking changes.</p> <p>Upgrade guides for both [ruleset maintainers/end-users][wiki-upgrade-4.0-end-users], as well as for [sniff developers and integrators][wiki-upgrade-4.0-extenders], have been published to the Wiki.</p> <p>You are strongly encouraged to read the upgrade guide applicable to your situation before upgrading.</p> <p>This release includes all improvements and bugfixes from PHP_CodeSniffer [4.0.0-beta1], [4.0.0-RC1], [3.13.3] and [3.13.4].</p> <h3>Changed</h3> <ul> <li>Tokenizer/PHP: fully qualified <code>exit</code>/<code>die</code>/<code>true</code>/<code>false</code>/<code>null</code> will be tokenized as the keyword token and the token <code>'content'</code> will include the leading backslash. <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1201">#1201</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/0525c73950de35ded110cffafb9892946d7771b5"><code>0525c73</code></a> Merge pull request <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1318">#1318</a> from PHPCSStandards/feature/changelog-4.0.1</li> <li><a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/4c09fb42780c391e9c2affa80269bd093af089bd"><code>4c09fb4</code></a> Changelog for the 4.0.1 release</li> <li><a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/7ed8ea2bce1603d8f925740a5d7045ee8e6d40d8"><code>7ed8ea2</code></a> Merge pull request <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1316">#1316</a> from PHPCSStandards/feature/tokenizer-php-switch-cas...</li> <li><a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/b80dc24cf99812c1847c887e41b4a218165360ff"><code>b80dc24</code></a> Various sniffs: update tests to safeguard handling of <code>case</code>/<code>default</code> with P...</li> <li><a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/6bd0af631b5f22d16bde057fd8be962c866913bb"><code>6bd0af6</code></a> Squiz/NonExecutableCode: bug fix - false positive with PHP close tag after ca...</li> <li><a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/6d61496ab04df59448b6a9e220be9c91c823926b"><code>6d61496</code></a> Squiz/SwitchDeclaration: make implied semicolon via close tag auto-fixable</li> <li><a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/21c0e80120f7bddf0e986f58ffa2facd32aff5f8"><code>21c0e80</code></a> PSR2/SwitchDeclaration: make implied semicolon via close tag auto-fixable</li> <li><a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/6327f7707a73c1e4d6bc8668a1c1ebba51ce27f1"><code>6327f77</code></a> Tokenizer/PHP: PHP close tag should be regarded as scope opener for switch ca...</li> <li><a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/93979308666822d67aed0720378bb9be6ef14e42"><code>9397930</code></a> Squiz/SwitchDeclaration: bug fix - fixer conflict for single line code (<a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1315">#1315</a>)</li> <li><a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/2c13a9078eb3a680dfbda085eb90e6c6bb05a023"><code>2c13a90</code></a> Merge pull request <a href="https://redirect.github.com/PHPCSStandards/PHP_CodeSniffer/issues/1308">#1308</a> from Soh1121/issue-968/fix-wrong-indentation-with-ar...</li> <li>Additional commits viewable in <a href="https://github.com/PHPCSStandards/PHP_CodeSniffer/compare/3.10.0...4.0.1">compare view</a></li> </ul> </details> <br />
manlycucumber (Migrated from github.com) reviewed 2026-06-30 22:56:23 +00:00
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin dependabot/composer/develop/squizlabs/php_codesniffer-tw-3.10or-tw-4.0:dependabot/composer/develop/squizlabs/php_codesniffer-tw-3.10or-tw-4.0
git switch dependabot/composer/develop/squizlabs/php_codesniffer-tw-3.10or-tw-4.0
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Directorium/Core!5
No description provided.